ipsets.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "ipsets.h"
  20
  21
  22 const struct fw3_option fw3_ipset_opts[] = {
  23         FW3_OPT("enabled",       bool,           ipset,     enabled),
  24
  25         FW3_OPT("name",          string,         ipset,     name),
  26         FW3_OPT("family",        family,         ipset,     family),
  27
  28         FW3_OPT("storage",       ipset_method,   ipset,     method),
  29         FW3_LIST("match",        ipset_datatype, ipset,     datatypes),
  30
  31         FW3_OPT("iprange",       address,        ipset,     iprange),
  32         FW3_OPT("portrange",     port,           ipset,     portrange),
  33
  34         FW3_OPT("netmask",       int,            ipset,     netmask),
  35         FW3_OPT("maxelem",       int,            ipset,     maxelem),
  36         FW3_OPT("hashsize",      int,            ipset,     hashsize),
  37         FW3_OPT("timeout",       int,            ipset,     timeout),
  38
  39         FW3_OPT("external",      string,         ipset,     external),
  40
  41         { }
  42 };
  43
  44 #define T(m, t1, t2, t3, r, o) \
  45         { FW3_IPSET_METHOD_##m, \
  46           FW3_IPSET_TYPE_##t1 | (FW3_IPSET_TYPE_##t2 << 8) | (FW3_IPSET_TYPE_##t3 << 16), \
  47           r, o }
  48
  49 enum ipset_optflag {
  50         OPT_IPRANGE   = (1 << 0),
  51         OPT_PORTRANGE = (1 << 1),
  52         OPT_NETMASK   = (1 << 2),
  53         OPT_HASHSIZE  = (1 << 3),
  54         OPT_MAXELEM   = (1 << 4),
  55         OPT_FAMILY    = (1 << 5),
  56 };
  57
  58 struct ipset_type {
  59         enum fw3_ipset_method method;
  60         uint32_t types;
  61         uint8_t required;
  62         uint8_t optional;
  63 };
  64
  65 static struct ipset_type ipset_types[] = {
  66         T(BITMAP, IP,   UNSPEC, UNSPEC, OPT_IPRANGE, OPT_NETMASK),
  67         T(BITMAP, IP,   MAC,    UNSPEC, OPT_IPRANGE, 0),
  68         T(BITMAP, PORT, UNSPEC, UNSPEC, OPT_PORTRANGE, 0),
  69
  70         T(HASH,   IP,   UNSPEC, UNSPEC, 0,
  71           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM | OPT_NETMASK),
  72         T(HASH,   NET,  UNSPEC, UNSPEC, 0,
  73           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
  74         T(HASH,   IP,   PORT,   UNSPEC, 0,
  75           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
  76         T(HASH,   NET,  PORT,   UNSPEC, 0,
  77           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
  78         T(HASH,   IP,   PORT,   IP,     0,
  79           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
  80         T(HASH,   IP,   PORT,   NET,    0,
  81           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
  82
  83         T(LIST,   SET,  UNSPEC, UNSPEC, 0, OPT_MAXELEM),
  84 };
  85
  86
  87 static bool
  88 check_types(struct uci_element *e, struct fw3_ipset *ipset)
  89 {
  90         int i = 0;
  91         uint32_t typelist = 0;
  92         struct fw3_ipset_datatype *type;
  93
  94         const char *methods[] = {
  95                 "(bug)",
  96                 "bitmap",
  97                 "hash",
  98                 "list",
  99         };
 100
 101         typelist = 0;
 102
 103         list_for_each_entry(type, &ipset->datatypes, list)
 104         {
 105                 if (i >= 3)
 106                 {
 107                         warn_elem(e, "must not have more than 3 datatypes assigned");
 108                         return false;
 109                 }
 110
 111                 typelist |= (type->type << (i++ * 8));
 112         }
 113
 114         /* find a suitable storage method if none specified */
 115         if (ipset->method == FW3_IPSET_METHOD_UNSPEC)
 116         {
 117                 for (i = 0; i < ARRAY_SIZE(ipset_types); i++)
 118                 {
 119                         if (ipset_types[i].types == typelist)
 120                         {
 121                                 ipset->method = ipset_types[i].method;
 122
 123                                 warn_elem(e, "defines no storage method, assuming '%s'",
 124                                           methods[ipset->method]);
 125
 126                                 break;
 127                         }
 128                 }
 129         }
 130
 131         //typelist |= ipset->method;
 132
 133         for (i = 0; i < ARRAY_SIZE(ipset_types); i++)
 134         {
 135                 if (ipset_types[i].method == ipset->method &&
 136                     ipset_types[i].types == typelist)
 137                 {
 138                         if (!ipset->external || !*ipset->external)
 139                         {
 140                                 if ((ipset_types[i].required & OPT_IPRANGE) &&
 141                                         !ipset->iprange.set)
 142                                 {
 143                                         warn_elem(e, "requires an ip range");
 144                                         return false;
 145                                 }
 146
 147                                 if ((ipset_types[i].required & OPT_PORTRANGE) &&
 148                                     !ipset->portrange.set)
 149                                 {
 150                                         warn_elem(e, "requires a port range");
 151                                         return false;
 152                                 }
 153
 154                                 if (!(ipset_types[i].required & OPT_IPRANGE) &&
 155                                     ipset->iprange.set)
 156                                 {
 157                                         warn_elem(e, "iprange ignored");
 158                                         ipset->iprange.set = false;
 159                                 }
 160
 161                                 if (!(ipset_types[i].required & OPT_PORTRANGE) &&
 162                                     ipset->portrange.set)
 163                                 {
 164                                         warn_elem(e, "portrange ignored");
 165                                         ipset->portrange.set = false;
 166                                 }
 167
 168                                 if (!(ipset_types[i].optional & OPT_NETMASK) &&
 169                                     ipset->netmask > 0)
 170                                 {
 171                                         warn_elem(e, "netmask ignored");
 172                                         ipset->netmask = 0;
 173                                 }
 174
 175                                 if (!(ipset_types[i].optional & OPT_HASHSIZE) &&
 176                                     ipset->hashsize > 0)
 177                                 {
 178                                         warn_elem(e, "hashsize ignored");
 179                                         ipset->hashsize = 0;
 180                                 }
 181
 182                                 if (!(ipset_types[i].optional & OPT_MAXELEM) &&
 183                                     ipset->maxelem > 0)
 184                                 {
 185                                         warn_elem(e, "maxelem ignored");
 186                                         ipset->maxelem = 0;
 187                                 }
 188
 189                                 if (!(ipset_types[i].optional & OPT_FAMILY) &&
 190                                     ipset->family != FW3_FAMILY_ANY)
 191                                 {
 192                                         warn_elem(e, "family ignored");
 193                                         ipset->family = FW3_FAMILY_ANY;
 194                                 }
 195                         }
 196
 197                         return true;
 198                 }
 199         }
 200
 201         warn_elem(e, "has an invalid combination of storage method and matches");
 202         return false;
 203 }
 204
 205 struct fw3_ipset *
 206 fw3_alloc_ipset(void)
 207 {
 208         struct fw3_ipset *ipset;
 209
 210         ipset = malloc(sizeof(*ipset));
 211
 212         if (!ipset)
 213                 return NULL;
 214
 215         memset(ipset, 0, sizeof(*ipset));
 216
 217         INIT_LIST_HEAD(&ipset->datatypes);
 218
 219         return ipset;
 220 }
 221
 222 void
 223 fw3_load_ipsets(struct fw3_state *state, struct uci_package *p)
 224 {
 225         struct uci_section *s;
 226         struct uci_element *e;
 227         struct fw3_ipset *ipset;
 228
 229         INIT_LIST_HEAD(&state->ipsets);
 230
 231         if (state->disable_ipsets)
 232                 return;
 233
 234         uci_foreach_element(&p->sections, e)
 235         {
 236                 s = uci_to_section(e);
 237
 238                 if (strcmp(s->type, "ipset"))
 239                         continue;
 240
 241                 ipset = fw3_alloc_ipset();
 242
 243                 if (!ipset)
 244                         continue;
 245
 246                 fw3_parse_options(ipset, fw3_ipset_opts, s);
 247
 248                 if (!ipset->name || !*ipset->name)
 249                 {
 250                         warn_elem(e, "must have a name assigned");
 251                 }
 252                 //else if (fw3_lookup_ipset(state, ipset->name) != NULL)
 253                 //{
 254                 //      warn_elem(e, "has duplicated set name '%s'", ipset->name);
 255                 //}
 256                 else if (list_empty(&ipset->datatypes))
 257                 {
 258                         warn_elem(e, "has no datatypes assigned");
 259                 }
 260                 else if (check_types(e, ipset))
 261                 {
 262                         list_add_tail(&ipset->list, &state->ipsets);
 263                         continue;
 264                 }
 265
 266                 fw3_free_ipset(ipset);
 267         }
 268 }
 269
 270
 271 static void
 272 create_ipset(struct fw3_ipset *ipset, struct fw3_state *state)
 273 {
 274         bool first = true;
 275         char s[INET6_ADDRSTRLEN];
 276
 277         struct fw3_ipset_datatype *type;
 278         struct fw3_address *a;
 279
 280         const char *methods[] = {
 281                 "(bug)",
 282                 "bitmap",
 283                 "hash",
 284                 "list",
 285         };
 286
 287         const char *types[] = {
 288                 "(bug)",
 289                 "ip",
 290                 "port",
 291                 "mac",
 292                 "net",
 293                 "set",
 294         };
 295
 296         if (ipset->external && *ipset->external)
 297                 return;
 298
 299         info("Creating ipset %s", ipset->name);
 300
 301         first = true;
 302         fw3_pr("create %s %s", ipset->name, methods[ipset->method]);
 303
 304         list_for_each_entry(type, &ipset->datatypes, list)
 305         {
 306                 fw3_pr("%c%s", first ? ':' : ',', types[type->type]);
 307                 first = false;
 308         }
 309
 310         if (ipset->iprange.set)
 311         {
 312                 a = &ipset->iprange;
 313
 314                 if (!a->range)
 315                 {
 316                         inet_ntop(a->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 317                                   &a->address.v6, s, sizeof(s));
 318
 319                         fw3_pr(" range %s/%u", s, a->mask);
 320                 }
 321                 else
 322                 {
 323                         inet_ntop(a->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 324                                   &a->address.v6, s, sizeof(s));
 325
 326                         fw3_pr(" range %s", s);
 327
 328                         inet_ntop(a->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 329                                   &a->address2.v6, s, sizeof(s));
 330
 331                         fw3_pr("-%s", s);
 332                 }
 333         }
 334         else if (ipset->portrange.set)
 335         {
 336                 fw3_pr(" range %u-%u",
 337                        ipset->portrange.port_min, ipset->portrange.port_max);
 338         }
 339
 340         if (ipset->family != FW3_FAMILY_ANY)
 341                 fw3_pr(" family inet%s", (ipset->family == FW3_FAMILY_V4) ? "" : "6");
 342
 343         if (ipset->timeout > 0)
 344                 fw3_pr(" timeout %u", ipset->timeout);
 345
 346         if (ipset->maxelem > 0)
 347                 fw3_pr(" maxelem %u", ipset->maxelem);
 348
 349         if (ipset->netmask > 0)
 350                 fw3_pr(" netmask %u", ipset->netmask);
 351
 352         if (ipset->hashsize > 0)
 353                 fw3_pr(" hashsize %u", ipset->hashsize);
 354
 355         fw3_pr("\n");
 356
 357         fw3_set_running(ipset, &state->running_ipsets);
 358 }
 359
 360 void
 361 fw3_create_ipsets(struct fw3_state *state)
 362 {
 363         struct fw3_ipset *ipset;
 364
 365         if (state->disable_ipsets)
 366                 return;
 367
 368         list_for_each_entry(ipset, &state->ipsets, list)
 369                 if (!fw3_lookup_ipset(state, ipset->name, true))
 370                         create_ipset(ipset, state);
 371
 372         fw3_pr("quit\n");
 373 }
 374
 375 void
 376 fw3_destroy_ipsets(struct fw3_state *state)
 377 {
 378         struct fw3_ipset *s, *tmp;
 379         int mask = (1 << FW3_FAMILY_V4) | (1 << FW3_FAMILY_V6);
 380
 381         list_for_each_entry_safe(s, tmp, &state->running_ipsets, running_list)
 382         {
 383                 if (!hasbit(state->defaults.flags, FW3_FAMILY_V4))
 384                         delbit(s->flags, FW3_FAMILY_V4);
 385
 386                 if (!hasbit(state->defaults.flags, FW3_FAMILY_V6))
 387                         delbit(s->flags, FW3_FAMILY_V6);
 388
 389                 if (!(s->flags & mask))
 390                 {
 391                         info("Deleting ipset %s", s->name);
 392
 393                         fw3_pr("flush %s\n", s->name);
 394                         fw3_pr("destroy %s\n", s->name);
 395
 396                         fw3_set_running(s, NULL);
 397                 }
 398         }
 399 }
 400
 401 struct fw3_ipset *
 402 fw3_lookup_ipset(struct fw3_state *state, const char *name, bool running)
 403 {
 404         struct fw3_ipset *s;
 405
 406         if (list_empty(&state->ipsets))
 407                 return NULL;
 408
 409         list_for_each_entry(s, &state->ipsets, list)
 410         {
 411                 if (strcmp(s->name, name))
 412                         continue;
 413
 414                 if (!running || s->running_list.next)
 415                         return s;
 416
 417                 break;
 418         }
 419
 420         return NULL;
 421 }